// SCAN REPORT

Js Reverse

93 tools. 52 can modify or destroy data without limits.

9 destructive tools with no built-in limits. Policy required.

Last updated: 1 Oct 2026

52 can modify or destroy data

41 read-only

93 tools total

Community server · catalogue entry checked 01/10/2026

How to control Js Reverse ↓

TOOL MAP

What Js Reverse exposes to your agents

Read (41) Write / Execute (43) Destructive / Financial (9)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Js Reverse tools

Destructive · Medium clear_browser_cache Clearing the browser cache is an irreversible operation that permanently removes cached resources. Destructive · Medium clear_cookies Clearing all browser cookies is an irreversible destructive action — once cookies are deleted, session tokens, authentication state, and stored preferences are permanently lost and cannot be recovered by the tool itself. Destructive · Medium delete_cookie The tool permanently deletes cookies, which cannot be undone. Destructive · High delete_token This tool permanently deletes stored tokens, which are typically authentication credentials or session identifiers.

52 of Js Reverse's 93 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Js Reverse

PolicyLayer is an MCP gateway — it sits between your AI agents and Js Reverse, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "clear_browser_cache": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "save_token": {
    "limits": [
      {
        "counter": "save_token_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "analyze_encoded_string": {
    "limits": [
      {
        "counter": "analyze_encoded_string_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Js Reverse — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON JS REVERSE →

Instant setup, no code required.

FULL CATALOGUE

All 93 Js Reverse tools

DESTRUCTIVE 9 tools

Destructive clear_browser_cache Clears the browser HTTP cache via CDP Network.clearBrowserCache so the Destructive clear_cookies Clears all browser cookies via CDP Network.clearBrowserCookies. Useful Destructive clear_network_conditions Resets network emulation (back online, no throttling) and clears any Destructive delete_cookie Deletes cookies matching the given name (optionally scoped by url, Destructive delete_token Delete a saved token by name. Destructive remove_breakpoint Removes a breakpoint by its ID. Use list_breakpoints to see active breakpoints. Destructive remove_dom_breakpoint Removes a DOM breakpoint from an element. Destructive remove_network_rule Removes a network interception rule by id. Fetch interception is Destructive remove_xhr_breakpoint Removes an XHR/Fetch breakpoint.

EXECUTE 39 tools

Execute add_network_rule Adds a network interception rule (replaces the old intercept_requests). Execute api_request Make an HTTP request from the browser context. Supports custom method, headers, body, and automatic token inje Execute batch_replay Replays multiple requests in sequence and summarises each response. Execute break_on_attribute_modified Sets a breakpoint that triggers when any attribute of an element is modified. Useful for tracking hidden field Execute break_on_node_removed Sets a breakpoint that triggers when an element is about to be removed from the DOM. Execute break_on_subtree_modified Sets a breakpoint that triggers when the DOM subtree of an element is modified (child added/removed). Useful f Execute break_on_xhr Sets a breakpoint that triggers when an XHR/Fetch request URL contains the specified string. Execute encode_protobuf Encode data to protobuf binary format without a .proto schema. Specify field numbers, types, and values to bui Execute evaluate_on_callframe Evaluates a JavaScript expression in the context of a specific call frame while paused. This allows you to ins Execute evaluate_script Evaluate a JavaScript function inside the currently selected page. Returns the response as JSON so returned va Execute hook_crypto_functions Automatically hooks common crypto library functions to log encryption/decryption calls. Supports CryptoJS, JSE Execute hook_function Hooks a JavaScript function to log its calls, arguments, and return values. Useful for understanding how funct Execute monitor_events Monitors DOM events on a specified element or window. Events will be logged to console. Execute monitor_eventsource Starts capturing Server-Sent Events (EventSource) messages via CDP. Execute monitor_form_submit Monitors form submissions to capture form data before it is sent. Useful for analyzing login forms and finding Execute monitor_input_changes Monitors changes to input fields in real-time. Captures every keystroke and value change. Useful for tracking Execute navigate_page Navigates the currently selected page to a URL. Execute new_page Creates a new page Execute pause Pauses JavaScript execution at the current point. Use this to interrupt running code. Execute replay_request Re-sends a captured request (by numeric id from search_network) from the Execute resume Resumes JavaScript execution after being paused at a breakpoint. Execution continues until the next breakpoint Execute set_breakpoint Sets a breakpoint in a JavaScript file at the specified line. The breakpoint will trigger when the code execut Execute set_breakpoint_on_text Sets a breakpoint on specific code (function name, statement, etc.) by searching for it and automatically dete Execute set_cache_disabled Toggles the browser cache for the page via CDP Network.setCacheDisabled. Execute set_extra_headers Sets extra HTTP headers sent with every subsequent request (CDP Execute set_network_conditions Emulates network conditions (offline, throttling, latency) and optionally Execute start_js_coverage Starts collecting JavaScript code coverage data. This tracks which parts of JavaScript code are executed. Execute step_into Steps into the next function call. Use this to enter and debug function bodies. Execute step_out Steps out of the current function, continuing until the function returns. Use this to quickly exit a function. Execute step_over Steps over to the next statement, treating function calls as a single step. Use this to move through code with Execute stop_eventsource_monitor Stops capturing EventSource messages. Captured data is retained. Execute stop_form_monitor Stops monitoring form submissions. Execute stop_input_monitor Stops monitoring input field changes. Execute stop_monitor Stops an event monitor. Execute stop_websocket_monitor Stops capturing WebSocket frames. Captured frames are retained. Execute trace_function Traces calls to a function by its name in the source code. Works for ANY function including module-internal fu Execute wait_for_request Blocks until a network request matching the filters is observed (across Execute wait_for_response Blocks until a network request matching the filters has received a Execute watch_global Watches a global variable for changes. When the variable is modified, logs the old and new values to console.

WRITE 4 tools

Write save_token Save an authentication token with a name for later use. Supports multiple tokens for different accounts/servic Write select_page Select a page as a context for future tool calls. Write set_active_token Set a saved token as the active token. The active token is automatically used by api_request when no explicit Write set_cookie Sets a cookie via the CDP Network domain. Either

READ 41 tools

Read analyze_encoded_string Analyzes a string to detect its encoding type (Base64, Hex, JWT, URL encoding, etc.) and attempts to decode it Read beautify_script Beautifies minified/compressed JavaScript code to make it more readable. Supports automatic indentation, line Read decode_protobuf Decode protobuf binary without a .proto schema. Provide inline data (hex/base64) OR a url to fetch and decode Read decode_response Decodes a captured response body (by numeric id from search_network) as Read deobfuscate AST-based JavaScript deobfuscation (powered by Babel). Parses the code into an AST and applies scope-safe tran Read detect_encryption Detects encryption algorithms, crypto libraries, and encoding methods. By default (scope= Read diff_globals Compares current global variables with a previous snapshot. Shows added, removed, and changed variables. Use a Read export_har Exports captured network traffic as a HAR 1.2 file (optionally filtered Read extract Unified web content extraction. Use Read extract_form_data Extract form structure and current values, including hidden fields. By default returns all matching forms; pas Read extract_metadata Extract page metadata including JSON-LD, Open Graph, Twitter cards, and standard meta tags. Read find_in_script Finds a string in a specific script and returns its exact line/column position with surrounding context. Ideal Read get_console_message Gets a console message by its ID. You can get all messages by calling ${listConsoleMessages.name}. Read get_cookies Reads cookies via the CDP Network domain, including httpOnly cookies Read get_paused_info Gets information about the current paused state including call stack, current location, and scope variables. U Read get_response_body Fetches the full response body of a captured request by its numeric id Read get_script_source Gets the source code of a JavaScript script by its script ID. Supports line range (for normal files) or charac Read get_storage Gets browser storage data including cookies, localStorage, and sessionStorage. Cookies are read via the Chrome Read inspect_object Deeply inspects a JavaScript object, showing its properties, prototype chain, and methods. Useful for understa Read list_breakpoints Lists all active breakpoints in the current debugging session. Read list_console_messages List all console messages for the currently selected page since the last navigation. Read list_eventsource_messages Lists captured Server-Sent Events, filterable by URL/content. Read list_globals Lists all global variables on the window object, excluding built-in browser APIs. Useful for finding custom va Read list_hooks Lists all active function hooks. Read list_network_requests List all requests for the currently selected page since the last navigation. Read list_network_rules Lists active network interception rules and their hit stats. Read list_pages Get a list of pages open in the browser. Read list_scripts Lists all JavaScript scripts loaded in the current page. Returns script ID, URL, and source map information. U Read list_tokens List all saved authentication tokens. Shows name, type, metadata, and which one is active. Read list_watchers Lists all active global variable watchers. Read list_websocket_connections Lists tracked WebSocket connections and their frame counts. Read list_websocket_messages Lists captured WebSocket frames, filterable by connection, direction, Read monitor_websocket Starts capturing WebSocket frames via the CDP Network domain. Unlike a Read search_in_sources Searches for a string or regex pattern in all loaded JavaScript sources. Returns matching lines with script ID Read search_network Searches captured network requests (CDP-backed store that survives Read snapshot_globals Takes a snapshot of current global variables for later comparison with diff_globals. Useful for finding what c Read stop_js_coverage Stops collecting JavaScript code coverage and generates a detailed report showing which code was executed and Read take_screenshot Take a screenshot of the page or element. Read take_snapshot Take a text snapshot of the currently selected page based on the a11y tree. The snapshot lists page elements a Read unhook_function Removes a previously installed function hook. Read unwatch_global Stops watching a global variable and restores original behavior.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Js Reverse

Can an AI agent delete data through the Js Reverse MCP server? +

Yes. The Js Reverse server exposes 9 destructive tools including clear_browser_cache, clear_cookies, clear_network_conditions. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Js Reverse? +

The Js Reverse server has 4 write tools including save_token, select_page, set_active_token. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Js Reverse.

How many tools does the Js Reverse MCP server expose? +

93 tools across 4 categories: Destructive, Execute, Read, Write. 41 are read-only. 52 can modify, create, or delete data.

How do I enforce a policy on Js Reverse? +

Register the Js Reverse MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Js Reverse tool call.

Deterministic rules across all 93 Js Reverse tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON JS REVERSE →

Instant setup, no code required.

93 Js Reverse tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Js Reverse's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →